I'm convinced there is some confusion.
Create a CA signed certificate using the GitHub App private key:
openssl req -new -x509 -key <file-name>.key -out <certificate-name>.pem -days 1095
If I understand correctly, the previously generated private key is the key used to sign the certificate you're issuing (it functions as the signing CA). This ...